codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/storage/record-identity.d.ts

@@ -0,0 +1,16 @@
+/** Derive a legacy record identity before its first persisted token rotation. */
+export declare function deriveAccountRecordId(account: {
+    accountId?: string;
+    email?: string;
+    refreshToken: string;
+    addedAt: number;
+}): string;
+/** Resolve the persisted identity, or derive it for a legacy row. */
+export declare function resolveAccountRecordId(account: {
+    recordId?: string;
+    accountId?: string;
+    email?: string;
+    refreshToken: string;
+    addedAt: number;
+}): string;
+//# sourceMappingURL=record-identity.d.ts.map

package/dist/lib/storage/record-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-identity.d.ts","sourceRoot":"","sources":["../../../lib/storage/record-identity.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CAChB,GACC,MAAM,CAQR;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACrC,OAAO,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CAChB,GACC,MAAM,CAGR"}

package/dist/lib/storage/record-identity.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+/** Derive a legacy record identity before its first persisted token rotation. */
+export function deriveAccountRecordId(account) {
+    const seed = [
+        account.addedAt,
+        account.accountId?.trim() ?? "",
+        account.email?.trim().toLowerCase() ?? "",
+        account.refreshToken.trim(),
+    ].join("\u0000");
+    return `record:${createHash("sha256").update(seed).digest("hex")}`;
+}
+/** Resolve the persisted identity, or derive it for a legacy row. */
+export function resolveAccountRecordId(account) {
+    const stored = account.recordId?.trim();
+    return stored || deriveAccountRecordId(account);
+}

package/dist/lib/storage/snapshot-merge.d.ts

@@ -0,0 +1,16 @@
+import type { AccountMetadataV3, AccountStorageV3 } from "./public-types.js";
+type CooldownRow = Pick<AccountMetadataV3, "coolingDownUntil" | "cooldownReason" | "refreshToken">;
+/**
+ * Preserve concurrent cooldown observations while allowing an unchanged blocker to clear.
+ * An auth-failure cooldown belongs to the credential it was recorded against: once
+ * the merge keeps a different refresh token (e.g. we won a single-use refresh the
+ * other process lost with invalid_grant), that side's auth blocker is obsolete.
+ * Other cooldown reasons are observations about the account and are kept.
+ */
+export declare function mergeAccountCooldown(base: CooldownRow, disk: CooldownRow, local: CooldownRow): Pick<AccountMetadataV3, "coolingDownUntil" | "cooldownReason">;
+/** Three-way persistence under the file transaction lock. Disk deletions win over stale runtime state. */
+export declare function mergeAccountSnapshot(base: AccountStorageV3 | null, current: AccountStorageV3 | null, local: AccountStorageV3): AccountStorageV3;
+/** Save observations independently of unresolved user-edit conflicts. Inventory stays disk-owned. */
+export declare function mergeAccountRuntimeObservations(base: AccountStorageV3, current: AccountStorageV3, local: AccountStorageV3): AccountStorageV3;
+export {};
+//# sourceMappingURL=snapshot-merge.d.ts.map

package/dist/lib/storage/snapshot-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-merge.d.ts","sourceRoot":"","sources":["../../../lib/storage/snapshot-merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA8D7E,KAAK,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,CAAC,CAAC;AACnG;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,gBAAgB,CAAC,CAW7J;AAqBD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CA0E/I;AAED,qGAAqG;AACrG,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAmB5I"}

package/dist/lib/storage/snapshot-merge.js

@@ -0,0 +1,206 @@
+import { getAccountIdentityKey } from "./identity.js";
+import { isRecord } from "../utils.js";
+const equal = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function conflict() {
+    throw Object.assign(Error("Account storage changed concurrently; reload before saving."), { code: "ESTALE" });
+}
+function mergeValue(base, disk, local) {
+    if (equal(base, local) || equal(disk, local))
+        return structuredClone(disk);
+    if (equal(base, disk))
+        return structuredClone(local);
+    if (base === undefined && isRecord(disk) && isRecord(local))
+        base = {};
+    if (isRecord(base) && isRecord(disk) && isRecord(local)) {
+        const result = Object.create(null);
+        for (const key of new Set([...Object.keys(base), ...Object.keys(disk), ...Object.keys(local)])) {
+            const value = mergeValue(base[key], disk[key], local[key]);
+            if (value !== undefined)
+                result[key] = value;
+        }
+        return result;
+    }
+    return conflict();
+}
+const byId = (rows) => new Map((rows ?? []).map(row => [row.id, row]));
+/**
+ * Merge workspaces by id, never by array position. Fields changed on one side
+ * win; enabled/disabledAt move as one unit, and when both sides changed it an
+ * intentional re-enable wins over a disable. Other two-sided edits conflict.
+ * Removal follows the account rule: a record removed on either side stays
+ * removed.
+ */
+function mergeWorkspaces(base, disk, local) {
+    const before = byId(base.workspaces), onDisk = byId(disk.workspaces), next = byId(local.workspaces);
+    const ids = [...onDisk.keys(), ...[...next.keys()].filter(id => !onDisk.has(id) && !before.has(id))];
+    const workspaces = [];
+    for (const id of ids) {
+        const b = before.get(id), d = onDisk.get(id), l = next.get(id);
+        if (!d || !l) {
+            // Present on one side only: an addition survives, a removal wins.
+            const added = d ?? l;
+            if (!b && added)
+                workspaces.push(structuredClone(added));
+            continue;
+        }
+        const state = (row) => ({ enabled: row?.enabled, disabledAt: row?.disabledAt });
+        const stateSource = equal(state(b), state(l)) ? d : equal(state(b), state(d)) ? l : d.enabled !== false ? d : l.enabled !== false ? l : (d.disabledAt ?? 0) >= (l.disabledAt ?? 0) ? d : l;
+        const pick = (row) => ({ ...row, enabled: stateSource.enabled, disabledAt: stateSource.disabledAt });
+        const merged = mergeValue(b ? pick(b) : undefined, pick(d), pick(l));
+        if (merged.disabledAt === undefined)
+            delete merged.disabledAt;
+        workspaces.push(merged);
+    }
+    const currentId = (row) => row.workspaces?.[row.currentWorkspaceIndex ?? 0]?.id;
+    const chosen = currentId(local) !== currentId(base) ? currentId(local) : currentId(disk);
+    let index = workspaces.findIndex(row => row.id === chosen);
+    if (index < 0 || workspaces[index]?.enabled === false) {
+        const enabled = workspaces.findIndex(row => row.enabled !== false);
+        index = enabled >= 0 ? enabled : Math.max(index, 0);
+    }
+    const untracked = [base, disk, local].every(row => row.currentWorkspaceIndex === undefined);
+    return { workspaces, currentWorkspaceIndex: untracked && index === 0 ? undefined : index };
+}
+/**
+ * Preserve concurrent cooldown observations while allowing an unchanged blocker to clear.
+ * An auth-failure cooldown belongs to the credential it was recorded against: once
+ * the merge keeps a different refresh token (e.g. we won a single-use refresh the
+ * other process lost with invalid_grant), that side's auth blocker is obsolete.
+ * Other cooldown reasons are observations about the account and are kept.
+ */
+export function mergeAccountCooldown(base, disk, local) {
+    const keptToken = local.refreshToken === base.refreshToken ? disk.refreshToken : local.refreshToken;
+    const current = (row) => row.cooldownReason === "auth-failure" && row.refreshToken !== keptToken
+        ? { ...row, coolingDownUntil: undefined, cooldownReason: undefined } : row;
+    disk = current(disk);
+    local = current(local);
+    const cleared = base.coolingDownUntil !== undefined && ((disk.coolingDownUntil === undefined && (local.coolingDownUntil === undefined || local.coolingDownUntil === base.coolingDownUntil)) ||
+        (local.coolingDownUntil === undefined && disk.coolingDownUntil === base.coolingDownUntil));
+    const cooldown = (disk.coolingDownUntil ?? 0) >= (local.coolingDownUntil ?? 0) ? disk : local;
+    return { coolingDownUntil: cleared ? undefined : cooldown.coolingDownUntil, cooldownReason: cleared ? undefined : cooldown.cooldownReason };
+}
+/** Runtime observations commute; user-owned edits retain conflict detection. */
+function mergeRuntimeAccount(base, disk, local) {
+    const limits = {};
+    for (const key of new Set([...Object.keys(disk.rateLimitResetTimes ?? {}), ...Object.keys(local.rateLimitResetTimes ?? {})])) {
+        const before = base.rateLimitResetTimes?.[key], a = disk.rateLimitResetTimes?.[key], b = local.rateLimitResetTimes?.[key];
+        // An explicit clear is an operation, not a new observation.
+        const clear = before !== undefined && ((a === undefined && b === before) || (b === undefined && a === before) || (a === undefined && b === undefined));
+        const value = clear ? undefined : Math.max(a ?? 0, b ?? 0);
+        if (value !== undefined)
+            limits[key] = value;
+    }
+    const runtime = {
+        rateLimitResetTimes: Object.keys(limits).length ? limits : undefined,
+        ...mergeAccountCooldown(base, disk, local),
+        lastSwitchReason: local.lastSwitchReason ?? disk.lastSwitchReason,
+        ...(disk.workspaces || local.workspaces ? mergeWorkspaces(base, disk, local) : {}),
+    };
+    // Omitted and true both mean enabled; serialization does not express a user edit.
+    const normalized = (row) => ({ ...row, enabled: row.enabled === false ? false : undefined });
+    return mergeValue(normalized(base), { ...normalized(disk), ...runtime }, { ...normalized(local), ...runtime });
+}
+/** Three-way persistence under the file transaction lock. Disk deletions win over stale runtime state. */
+export function mergeAccountSnapshot(base, current, local) {
+    if (!base) {
+        if (!current)
+            return structuredClone(local);
+        // An unavailable initial read is not authority to replace the inventory.
+        base = { version: 3, accounts: [], activeIndex: 0 };
+    }
+    if (!current && base.accounts.length === 0 && "restoreReason" in base && base.restoreReason === "missing-storage")
+        current = { version: 3, accounts: [], activeIndex: 0 };
+    if (!current)
+        return conflict();
+    const aliases = new Map();
+    for (const row of [...base.accounts, ...current.accounts, ...local.accounts]) {
+        const key = getAccountIdentityKey(row);
+        if (!key || !row.recordId)
+            continue;
+        const ids = aliases.get(key) ?? new Set();
+        ids.add(row.recordId);
+        aliases.set(key, ids);
+    }
+    const identity = (row) => {
+        if (row.recordId)
+            return row.recordId;
+        const key = getAccountIdentityKey(row), ids = key ? aliases.get(key) : undefined;
+        return ids?.size === 1 ? [...ids][0] : key;
+    };
+    const index = (rows) => {
+        const map = new Map();
+        for (const row of rows) {
+            const key = identity(row);
+            if (!key || map.has(key))
+                return conflict();
+            map.set(key, row);
+        }
+        return map;
+    };
+    const old = index(base.accounts), disk = index(current.accounts), proposed = index(local.accounts);
+    const accounts = [];
+    for (const [key, row] of disk) {
+        const prior = old.get(key), next = proposed.get(key);
+        if (prior && !next)
+            continue; // Explicit local removal of a previously known record.
+        if (!prior) {
+            if (next && !equal(row, next))
+                conflict();
+            accounts.push(structuredClone(row));
+            continue;
+        }
+        if (!next)
+            continue;
+        const lastUsed = Math.max(row.lastUsed, next.lastUsed);
+        const merged = mergeRuntimeAccount(prior, { ...row, lastUsed }, { ...next, lastUsed });
+        accounts.push(merged);
+    }
+    for (const [key, row] of proposed)
+        if (!old.has(key) && !disk.has(key))
+            accounts.push(structuredClone(row));
+    const pointer = (storage, value) => { const row = value === undefined ? undefined : storage.accounts[value]; return row ? identity(row) : undefined; };
+    const position = (id) => id === undefined ? undefined : accounts.findIndex(row => identity(row) === id);
+    const pick = (before, onDisk, next) => {
+        const oldId = pointer(base, before), diskId = pointer(current, onDisk), localId = pointer(local, next);
+        return position(localId !== oldId ? localId : diskId);
+    };
+    // Pointer metadata must be compared by identity, never by mutable list positions.
+    const fields = (storage) => Object.fromEntries(Object.entries(storage).filter(([key]) => !["accounts", "activeIndex", "activeIndexByFamily", "pinnedAccountIndex", "restoreEligible", "restoreReason"].includes(key)));
+    const result = { ...mergeValue(fields(base), fields(current), fields(local)), accounts, activeIndex: Math.max(0, pick(base.activeIndex, current.activeIndex, local.activeIndex) ?? 0) };
+    result.activeIndexByFamily = {};
+    for (const family of new Set([...Object.keys(base.activeIndexByFamily ?? {}), ...Object.keys(current.activeIndexByFamily ?? {}), ...Object.keys(local.activeIndexByFamily ?? {})])) {
+        const f = family;
+        result.activeIndexByFamily[f] = Math.max(0, pick(base.activeIndexByFamily?.[f], current.activeIndexByFamily?.[f], local.activeIndexByFamily?.[f]) ?? 0);
+    }
+    const pinned = pick(base.pinnedAccountIndex, current.pinnedAccountIndex, local.pinnedAccountIndex);
+    if (pinned !== undefined && pinned >= 0)
+        result.pinnedAccountIndex = pinned;
+    return result;
+}
+/** Save observations independently of unresolved user-edit conflicts. Inventory stays disk-owned. */
+export function mergeAccountRuntimeObservations(base, current, local) {
+    const observations = structuredClone(base);
+    const matches = (a, b) => a.recordId && b.recordId
+        ? a.recordId === b.recordId : getAccountIdentityKey(a) === getAccountIdentityKey(b);
+    for (const prior of observations.accounts) {
+        const next = local.accounts.find(row => matches(prior, row));
+        if (!next)
+            continue;
+        prior.lastUsed = Math.max(prior.lastUsed, next.lastUsed);
+        for (const field of ["rateLimitResetTimes", "coolingDownUntil", "cooldownReason", "lastSwitchReason"]) {
+            if (next[field] === undefined)
+                delete prior[field];
+            else
+                Object.assign(prior, { [field]: structuredClone(next[field]) });
+        }
+        // Preserve runtime workspace disables without committing labels or workspace selection.
+        for (const workspace of prior.workspaces ?? []) {
+            const updated = next.workspaces?.find(row => row.id === workspace.id);
+            if (updated) {
+                workspace.enabled = updated.enabled;
+                workspace.disabledAt = updated.disabledAt;
+            }
+        }
+    }
+    return mergeAccountSnapshot(base, current, observations);
+}

package/dist/lib/storage/transactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transactions.d.ts","sourceRoot":"","sources":["../../../lib/storage/transactions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEnF,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CAChB,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,2BAA2B,IACxC,wBAAwB,GACxB,SAAS,CAEX;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAChD,KAAK,EAAE,wBAAwB,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASnE;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,EACf,IAAI,EAAE;IACL,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D,GACC,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,EACf,IAAI,EAAE;IACL,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpD,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,mBAAmB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,iCAAiC,EAAE,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,KACxC,gBAAgB,CAAC;IACtB,gBAAgB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,KAAK,IAAI,CAAC;CACnE,GACC,OAAO,CAAC,CAAC,CAAC,CA6CZ"}
+{"version":3,"file":"transactions.d.ts","sourceRoot":"","sources":["../../../lib/storage/transactions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGnF,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CAChB,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,2BAA2B,IACxC,wBAAwB,GACxB,SAAS,CAEX;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAChD,KAAK,EAAE,wBAAwB,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASnE;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,EACf,IAAI,EAAE;IACL,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D,GACC,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,EACf,IAAI,EAAE;IACL,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpD,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,mBAAmB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,iCAAiC,EAAE,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,KACxC,gBAAgB,CAAC;IACtB,gBAAgB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,KAAK,IAAI,CAAC;CACnE,GACC,OAAO,CAAC,CAAC,CAAC,CA6CZ"}

package/dist/lib/storage/transactions.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { withFileTransactionLock } from "./file-lock.js";
 let storageMutex = Promise.resolve();
 const transactionSnapshotContext = new AsyncLocalStorage();
 const storageLockHeldContext = new AsyncLocalStorage();
@@ -29,7 +30,7 @@ export function withStorageLock(fn) {
         .finally(() => releaseLock());
 }
 export async function withAccountStorageTransaction(handler, deps) {
-    return withStorageLock(async () => {
+    return withStorageLock(() => withFileTransactionLock(deps.getStoragePath(), async () => {
         const state = {
             snapshot: await deps.loadCurrent(),
             storagePath: deps.getStoragePath(),
@@ -41,10 +42,10 @@ export async function withAccountStorageTransaction(handler, deps) {
             state.snapshot = storage;
         };
         return transactionSnapshotContext.run(state, () => handler(current, persist));
-    });
+    }));
 }
 export async function withAccountAndFlaggedStorageTransaction(handler, deps) {
-    return withStorageLock(async () => {
+    return withStorageLock(() => withFileTransactionLock(deps.getStoragePath(), async () => {
         const state = {
             snapshot: await deps.loadCurrent(),
             storagePath: deps.getStoragePath(),
@@ -78,5 +79,5 @@ export async function withAccountAndFlaggedStorageTransaction(handler, deps) {
             }
         };
         return transactionSnapshotContext.run(state, () => handler(current, persist, currentFlagged));
-    });
+    }));
 }

package/dist/lib/storage.d.ts

@@ -5,6 +5,8 @@ export { formatStorageErrorHint, toStorageError, } from "./storage/error-hints.j
 export { getAccountIdentityKey, normalizeEmailKey, } from "./storage/identity.js";
 import type { AccountMetadataV3, AccountStorageV3, CooldownReason, FlaggedAccountMetadataV1, FlaggedAccountStorageV1, RateLimitStateV3 } from "./storage/public-types.js";
 import { type NamedBackupSummary } from "./storage/named-backups.js";
+import { recordPendingAuth } from "./storage/pending-auth.js";
+export { recordPendingAuth };
 export type { StorageHealthSummary, CooldownReason, RateLimitStateV3, AccountMetadataV3, AccountStorageV3, FlaggedAccountMetadataV1, FlaggedAccountStorageV1, BackupMetadata, RestoreAssessment, NamedBackupSummary, };
 type AccountLike = {
     accountId?: string;
@@ -142,6 +144,8 @@ export declare function loadAccounts(): Promise<AccountStorageV3 | null>;
 export declare function getBackupMetadata(): Promise<BackupMetadata>;
 export declare function getRestoreAssessment(): Promise<RestoreAssessment>;
 export declare function inspectStorageHealth(): Promise<StorageHealthSummary>;
+/** Code for a merge base that cannot be read; distinct from an ESTALE edit conflict. */
+export declare const ACCOUNT_STORAGE_UNREADABLE = "EACCOUNTSUNREADABLE";
 export declare function withAccountStorageTransaction<T>(handler: (current: AccountStorageV3 | null, persist: (storage: AccountStorageV3) => Promise<void>) => Promise<T>): Promise<T>;
 export declare function withAccountAndFlaggedStorageTransaction<T>(handler: (current: AccountStorageV3 | null, persist: (accountStorage: AccountStorageV3, flaggedStorage: FlaggedAccountStorageV1) => Promise<void>, currentFlagged: FlaggedAccountStorageV1) => Promise<T>): Promise<T>;
 export declare function withFlaggedStorageTransaction<T>(handler: (current: FlaggedAccountStorageV1, persist: (storage: FlaggedAccountStorageV1) => Promise<void>) => Promise<T>): Promise<T>;
@@ -152,6 +156,8 @@ export declare function withFlaggedStorageTransaction<T>(handler: (current: Flag
  * @param storage - Account storage data to save
  * @throws StorageError with platform-aware hints on failure
  */
+/** Clone a loaded working snapshot without losing its optimistic-concurrency baseline. */
+export declare function cloneTrackedAccountStorage(storage: AccountStorageV3): AccountStorageV3;
 export declare function saveAccounts(storage: AccountStorageV3): Promise<void>;
 /**
  * Deletes the account storage file from disk.

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAqJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAmBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B;IACF,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA6CA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA4CpC,OAAO,EAAwD,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAQ7B,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAqJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAmBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B;IACF,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA6CA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAibD,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAiChE,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAKtF;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}

package/dist/lib/storage.js

@@ -50,7 +50,16 @@ import { buildRestoreAssessment } from "./storage/restore-assessment.js";
 import { restoreAccountsFromBackupEntry } from "./storage/restore-backup-entry.js";
 import { createEmptyStorageWithRestoreMetadata as createEmptyStorageWithMetadata, withRestoreMetadata, } from "./storage/restore-metadata.js";
 import { loadAccountsFromPath, parseAndNormalizeStorage, } from "./storage/storage-parser.js";
-import { getTransactionSnapshotState, isStorageLockHeld, runInTransactionSnapshotContext, withAccountStorageTransaction as runWithAccountStorageTransaction, withStorageLock, } from "./storage/transactions.js";
+import { getTransactionSnapshotState, isStorageLockHeld, runInTransactionSnapshotContext, withAccountStorageTransaction as runWithAccountStorageTransaction, withStorageLock as withProcessStorageLock, } from "./storage/transactions.js";
+import { withFileTransactionLock } from "./storage/file-lock.js";
+import { mergeAccountSnapshot } from "./storage/snapshot-merge.js";
+import { applyPendingAuth, clearPendingAuth, prunePendingAuth, recordPendingAuth } from "./storage/pending-auth.js";
+export { recordPendingAuth };
+const loadedAccountSnapshots = new WeakMap();
+function withStorageLock(action) {
+    const path = getStoragePath();
+    return withProcessStorageLock(() => withFileTransactionLock(path, action));
+}
 const log = createLogger("storage");
 const ACCOUNTS_FILE_NAME = "openai-codex-accounts.json";
 const FLAGGED_ACCOUNTS_FILE_NAME = "openai-codex-flagged-accounts.json";
@@ -1069,7 +1078,10 @@ export function readPinAndGenFromDisk(path, options) {
  * @returns AccountStorageV3 if file exists and is valid, null otherwise
  */
 export async function loadAccounts() {
-    return loadAccountsInternal(saveAccounts);
+    const storage = await applyPendingAuth(getStoragePath(), await loadAccountsInternal(saveAccounts));
+    if (storage)
+        loadedAccountSnapshots.set(storage, structuredClone(storage));
+    return storage;
 }
 export async function getBackupMetadata() {
     const storagePath = getStoragePath();
@@ -1456,6 +1468,13 @@ async function loadAccountsForExport() {
     }
 }
 async function saveAccountsUnlocked(storage) {
+    await saveAccountsUnlockedToDisk(storage);
+    // A persisted (or superseded) pending rotated credential is no longer needed.
+    await prunePendingAuth(getStoragePath(), storage).catch((error) => {
+        log.warn("Failed to prune pending rotated credentials", { code: typeof error.code === "string" && /^[A-Z_]{1,40}$/.test(error.code ?? "") ? error.code : "INVALID_PENDING_AUTH" });
+    });
+}
+async function saveAccountsUnlockedToDisk(storage) {
     const path = getStoragePath();
     const resetMarkerPath = getIntentionalResetMarkerPath(path);
     const walPath = getAccountsWalPath(path);
@@ -1577,10 +1596,40 @@ function cloneFlaggedStorageForPersistence(storage) {
         accounts: structuredClone(storage?.accounts ?? []),
     };
 }
+/** Code for a merge base that cannot be read; distinct from an ESTALE edit conflict. */
+export const ACCOUNT_STORAGE_UNREADABLE = "EACCOUNTSUNREADABLE";
+async function loadPrimaryAccountsForMerge() {
+    const path = getStoragePath();
+    if (existsSync(getIntentionalResetMarkerPath(path))) {
+        return createEmptyStorageWithMetadata(false, "intentional-reset");
+    }
+    try {
+        const { normalized } = await loadAccountsFromPath(path, {
+            normalizeAccountStorage,
+            isRecord,
+        });
+        if (!normalized)
+            throw new Error("Invalid primary account storage");
+        // The merge base must carry pending rotated credentials too, or a merge
+        // would keep the spent token that is still on disk.
+        return applyPendingAuth(path, normalized);
+    }
+    catch (cause) {
+        const code = cause.code;
+        // The journal is written before the primary and removed after it, so a
+        // journal beside a missing primary is the newest state, not a stale
+        // backup. Without one, the deletion is authoritative.
+        if (code === "ENOENT")
+            return applyPendingAuth(path, await loadAccountsFromJournal(path, { silent: true }));
+        // A locked or torn primary may hold newer state than any backup, so it is
+        // never replaced by a recovered copy here.
+        throw Object.assign(new Error(`Account storage could not be read${typeof code === "string" ? ` (${code})` : ""}; nothing was saved.`), { code: ACCOUNT_STORAGE_UNREADABLE, cause });
+    }
+}
 export async function withAccountStorageTransaction(handler) {
     return runWithAccountStorageTransaction(handler, {
         getStoragePath,
-        loadCurrent: () => loadAccountsInternal(saveAccountsUnlocked),
+        loadCurrent: loadPrimaryAccountsForMerge,
         saveAccounts: saveAccountsUnlocked,
     });
 }
@@ -1588,7 +1637,7 @@ export async function withAccountAndFlaggedStorageTransaction(handler) {
     return withStorageLock(async () => {
         const storagePath = getStoragePath();
         const state = {
-            snapshot: await loadAccountsInternal(saveAccountsUnlocked),
+            snapshot: await loadPrimaryAccountsForMerge(),
             storagePath,
             active: true,
         };
@@ -1596,7 +1645,8 @@ export async function withAccountAndFlaggedStorageTransaction(handler) {
         const currentFlagged = await loadFlaggedAccounts();
         const persist = async (accountStorage, flaggedStorage) => {
             const previousAccounts = cloneAccountStorageForPersistence(state.snapshot);
-            const nextAccounts = cloneAccountStorageForPersistence(accountStorage);
+            const baseline = loadedAccountSnapshots.get(accountStorage);
+            const nextAccounts = cloneAccountStorageForPersistence(baseline ? mergeAccountSnapshot(baseline, state.snapshot, accountStorage) : accountStorage);
             const nextFlagged = cloneFlaggedStorageForPersistence(flaggedStorage);
             await saveAccountsUnlocked(nextAccounts);
             try {
@@ -1659,11 +1709,29 @@ export async function withFlaggedStorageTransaction(handler) {
  * @param storage - Account storage data to save
  * @throws StorageError with platform-aware hints on failure
  */
+/** Clone a loaded working snapshot without losing its optimistic-concurrency baseline. */
+export function cloneTrackedAccountStorage(storage) {
+    const clone = structuredClone(storage);
+    const baseline = loadedAccountSnapshots.get(storage);
+    if (baseline)
+        loadedAccountSnapshots.set(clone, structuredClone(baseline));
+    return clone;
+}
 export async function saveAccounts(storage) {
     return saveAccountsEntry({
         storage,
         withStorageLock,
-        saveUnlocked: saveAccountsUnlocked,
+        saveUnlocked: async (proposed) => {
+            const baseline = loadedAccountSnapshots.get(proposed);
+            const snapshot = baseline ? mergeAccountSnapshot(baseline, await loadPrimaryAccountsForMerge(), proposed) : proposed;
+            await saveAccountsUnlocked(snapshot);
+            if (baseline) {
+                for (const key of Object.keys(proposed))
+                    Reflect.deleteProperty(proposed, key);
+                Object.assign(proposed, structuredClone(snapshot));
+                loadedAccountSnapshots.set(proposed, structuredClone(snapshot));
+            }
+        },
     });
 }
 /**
@@ -1672,7 +1740,7 @@ export async function saveAccounts(storage) {
  */
 export async function clearAccounts() {
     const path = getStoragePath();
-    return clearAccountsEntry({
+    await clearAccountsEntry({
         path,
         withStorageLock,
         resetMarkerPath: getIntentionalResetMarkerPath(path),
@@ -1683,6 +1751,8 @@ export async function clearAccounts() {
             log.error(message, details);
         },
     });
+    // Pending rotated credentials belong to the cleared pool.
+    await clearPendingAuth(path);
 }
 export async function loadFlaggedAccounts() {
     return loadFlaggedAccountsEntry({

package/dist/lib/ui/auth-menu-builder.d.ts

@@ -47,6 +47,8 @@ export type AuthMenuAction = {
     type: "fix";
 } | {
     type: "settings";
+} | {
+    type: "api-models";
 } | {
     type: "fresh";
 } | {

package/dist/lib/ui/auth-menu-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-menu-builder.d.ts","sourceRoot":"","sources":["../../../lib/ui/auth-menu-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,MAAM,MAAM,aAAa,GACtB,QAAQ,GACR,IAAI,GACJ,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,UAAU,GACV,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtB,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAC;AAQhG,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAUD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQxE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAyDrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAQzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAU9D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAiBvF;AAwBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAGvE;AAuFD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,aAAa,EAAE,MAAM,GACnB,MAAM,CAWR;AA6DD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAAG,MAAM,CA8C1G;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAqB/D"}
+{"version":3,"file":"auth-menu-builder.d.ts","sourceRoot":"","sources":["../../../lib/ui/auth-menu-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,MAAM,MAAM,aAAa,GACtB,QAAQ,GACR,IAAI,GACJ,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,UAAU,GACV,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtB,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAC;AAQhG,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAUD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQxE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAyDrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAQzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAU9D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAiBvF;AAwBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAGvE;AAuFD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,aAAa,EAAE,MAAM,GACnB,MAAM,CAWR;AA6DD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAAG,MAAM,CA8C1G;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAsB/D"}

package/dist/lib/ui/auth-menu-builder.js

@@ -362,6 +362,7 @@ export function authMenuFocusKey(action) {
         case "add":
         case "forecast":
         case "fix":
+        case "api-models":
         case "settings":
         case "fresh":
         case "check":

package/dist/lib/ui/auth-menu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-menu.d.ts","sourceRoot":"","sources":["../../../lib/ui/auth-menu.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,EAAE,MAAM,WAAW,CAAC;AAMxC,OAAO,EAWN,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GACf,MAAM,wBAAwB,CAAC;AAiBhC,wBAAsB,YAAY,CACjC,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAyLzB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAmErF;AAED,OAAO,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"auth-menu.d.ts","sourceRoot":"","sources":["../../../lib/ui/auth-menu.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,EAAE,MAAM,WAAW,CAAC;AAMxC,OAAO,EAWN,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GACf,MAAM,wBAAwB,CAAC;AAiBhC,wBAAsB,YAAY,CACjC,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC3B,OAAO,CAAC,cAAc,CAAC,CA0LzB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAmErF;AAED,OAAO,EAAE,KAAK,EAAE,CAAC"}

package/dist/lib/ui/auth-menu.js

@@ -49,6 +49,7 @@ export async function showAuthMenu(accounts, options = {}) {
             { label: UI_COPY.mainMenu.checkAccounts, value: { type: "check" }, color: "green" },
             { label: UI_COPY.mainMenu.bestAccount, value: { type: "forecast" }, color: "green" },
             { label: UI_COPY.mainMenu.fixIssues, value: { type: "fix" }, color: "green" },
+            { label: "API credentials and models", value: { type: "api-models" }, color: "green" },
             { label: UI_COPY.mainMenu.settings, value: { type: "settings" }, color: "green" },
             { label: "", value: { type: "cancel" }, separator: true },
             { label: UI_COPY.mainMenu.moreChecks, value: { type: "cancel" }, kind: "heading" },

package/dist/lib/ui/check-progress.d.ts

@@ -0,0 +1,8 @@
+type ProgressOutput = {
+    isTTY?: boolean;
+    write: (text: string) => unknown;
+};
+/** Indeterminate progress: elapsed time is real; no guessed completion percentage. */
+export declare function withCheckProgress<T>(label: string | (() => string), operation: () => Promise<T>, log?: (message: string) => void, output?: ProgressOutput): Promise<T>;
+export {};
+//# sourceMappingURL=check-progress.d.ts.map

package/dist/lib/ui/check-progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-progress.d.ts","sourceRoot":"","sources":["../../../lib/ui/check-progress.ts"],"names":[],"mappings":"AAEA,KAAK,cAAc,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAAE,CAAC;AAE5E,sFAAsF;AACtF,wBAAsB,iBAAiB,CAAC,CAAC,EACxC,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,GAAG,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAA2D,EACrF,MAAM,GAAE,cAA+B,GACrC,OAAO,CAAC,CAAC,CAAC,CAqBZ"}

package/dist/lib/ui/check-progress.js

@@ -0,0 +1,30 @@
+import { ANSI } from "./ansi.js";
+/** Indeterminate progress: elapsed time is real; no guessed completion percentage. */
+export async function withCheckProgress(label, operation, log = message => { process.stdout.write(`${message}\n`); }, output = process.stdout) {
+    const message = () => typeof label === "function" ? label() : label;
+    const started = Date.now();
+    const interactive = output.isTTY === true;
+    const frames = ["|", "/", "-", "\\"];
+    let frame = 0;
+    const elapsed = () => Math.floor((Date.now() - started) / 1000);
+    const render = () => {
+        if (interactive)
+            output.write(`\r${ANSI.clearLine}${frames[frame++ % frames.length]} ${message()} (${elapsed()}s)`);
+        else
+            log(`${message()}... ${elapsed()}s elapsed`);
+    };
+    if (interactive)
+        render();
+    else
+        log(`${message()}...`);
+    const timer = setInterval(render, interactive ? 120 : 5000);
+    timer.unref?.();
+    try {
+        return await operation();
+    }
+    finally {
+        clearInterval(timer);
+        if (interactive)
+            output.write(`\r${ANSI.clearLine}`);
+    }
+}

package/dist/lib/ui/format.d.ts

@@ -1,4 +1,4 @@
-import type { UiRuntimeOptions } from "./runtime.js";
+import { type UiRuntimeOptions } from "./runtime.js";
 export type UiTextTone = "primary" | "heading" | "accent" | "muted" | "success" | "warning" | "danger" | "normal";
 /**
  * Colorize a text string according to the UI theme and tone.
@@ -59,4 +59,6 @@ export declare function formatUiBadge(ui: UiRuntimeOptions, label: string, tone?
  * Token redaction: does not handle or emit sensitive tokens.
  */
 export declare function quotaToneFromLeftPercent(leftPercent: number): Extract<UiTextTone, "success" | "warning" | "danger">;
+/** Style human-readable reports; JSON callers must bypass this presentation helper. */
+export declare function styleReportText(text: string, tone?: UiTextTone): string;
 //# sourceMappingURL=format.d.ts.map

package/dist/lib/ui/format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../lib/ui/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,UAAU,GACnB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,OAAO,GACP,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAuGZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAqB,GAAG,MAAM,CAKnG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5E;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAG7E;AAED,wBAAgB,YAAY,CAC3B,EAAE,EAAE,gBAAgB,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,UAAqB,GACzB,MAAM,CAIR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,gBAAgB,EACpB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,UAAqB,GAC9B,MAAM,CAKR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,gBAAgB,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAY,GACxD,MAAM,CAKR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,CAIvD"}
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../lib/ui/format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1E,MAAM,MAAM,UAAU,GACnB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,OAAO,GACP,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAuGZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAqB,GAAG,MAAM,CAKnG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5E;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAG7E;AAED,wBAAgB,YAAY,CAC3B,EAAE,EAAE,gBAAgB,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,UAAqB,GACzB,MAAM,CAIR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC/B,EAAE,EAAE,gBAAgB,EACpB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,UAAqB,GAC9B,MAAM,CAKR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC5B,EAAE,EAAE,gBAAgB,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAY,GACxD,MAAM,CAKR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,CAIvD;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAqB,GAAG,MAAM,CAGjF"}